Some service providers use conventional risk-based authentication systems to assess risks of processing customer transactions. For example, an online bank may employ a risk engine of such a risk-based authentication system to assign risk scores to banking transactions where higher risk scores indicate higher risk.
In generating a risk score, the risk engine takes, as input values, various transaction attributes (e.g., time of receipt, IP address). For each customer of the online bank, there is an associated history based on values of the transaction attributes associated with previous transactions involving that customer. The risk engine incorporates the history associated with the customer into an evaluation of the risk score. Significant variation of one or more attribute values from those in the customer's history may signify that the banking transaction has a high risk.
For example, suppose that a particular customer historically submitted transaction requests to the online bank at 3:00 PM from a particular internet service provider (ISP), and, under the customer's identifier, a user submits a new transaction request at 2:00 AM from a different ISP. The different ISP would give rise to a different IP address than that historically associated with the particular customer. In this case, owing to the different IP address and the unusual time that the transaction was submitted, the risk engine would assign a larger risk score to a transaction resulting from the new transaction request.
Unfortunately, there are deficiencies with the above-described conventional risk-based authentication systems. For example, an IP address can be used to determine an approximate geolocation from which a user connected to a network via an ISP submits a transaction request. However, for a user conducting a transaction from a mobile device, geolocation is typically derived from a cell tower identifier or GPS coordinates.
Because of the nature of data gathering from cell towers and GPS units in mobile devices, it is possible that a risk-based authentication system could perceive a small change in location as a large change and therefore deem it risky. In particular, a typical resolution for geolocation from GPS coordinates is about 25 meters, although this number can vary. The translation of GPS coordinates into a geolocation at such a resolution is frequently very sensitive to noise and other external factors. For example, at one instant, a first user conducts a transaction with the mobile device facing north, resulting in a geolocation from the GPS coordinates that includes a first address. A second user conducts another transaction from the same location with the mobile device facing east, resulting in a geolocation from slightly different GPS coordinates that includes a second address differing from the first address. The second address may be a few meters or as far as several kilometers away from the first address. Similar problems also exist in non-GPS methods of collecting geolocation such as cell tower triangulation. For example, two users in a city having many cell towers can have cell signals point to different cell towers despite the users being a few centimeters apart; such users would be assigned geolocations much further apart than their actual locations.
Such hypersensitivity to noise and other external factors presents a problem for conventional risk-based authentication systems. Because the conventional risk-based authentication systems described above rely on previous behavior of attributes such as geolocation, a noisy history of geolocation may lead to inaccurate risk scores being assigned to transactions. In other words, when the process of obtaining geolocation is excessively noisy and therefore unrepeatable, conventional risk-based authentication systems may create a large number of false positives, undermining the ability to identify the riskiest transactions.
Additionally, it should be understood that some conventional risk-based authentication systems can also assign a high risk to transactions from a certain international region. For example, the systems may assign a high risk to all transactions from a country in the region due to social, economic and/or geopolitical reasons in the country.
However, this imprecise approach can lead to all transactions emanating from the country being treated in a similar manner regardless of the veracity of the transaction. This approach can deprive customers in the country the opportunity to perform a transaction due to circumstances outside of their control.